Chrome 81: Near Field Communications, Augmented Reality, and More

Depends on what you mean with an interaction. Technically it would be possible to stack write operations, so you could just keep a tag to a close proximity of the adapter, and keep writing messages one after another.

With the webnfc.app, you can only write a single NDEF message with single record of either URL or Text, during single interaction.

I don't think you understand the comparison. Any native code that runs on your OS can do almost anything, like access your webcam. Code that runs in your browser can't do that unless you (the browser) grant the permission, or it finds a series of exploits.

If you are suggesting browsers shouldn't offer access to webcams etc at all, that would not make the world more secure because the web would just die and we'd all be back to running native code.

Okay, from a software engineering perspective you're 100% right. Browsers are a very complex system and they'll continue to grow. But try to see it from a user perspective.

You as a software developer know how your system works. You know what components you used, how to compile and install and how to secure. Your average user (depending on the target audience) doesn't know anything like this. Most users are happy when their current installation works, they often don't want to update, without realizing that this comes with the cost of their security.

I feel like webapps are the easier way to keep users with no experience secure.

> Whereas most kernels are easy to understand

Have you taken a look at Linux?!

> And yet, sites exfiltrate enormous amounts of behavioral information. Whereas with a desktop app, I can just put it in a sandbox without network access and I am 100% sure that no data gets uploaded to anyone.

I don't see how that has anything to do with the security of the platform itself. Sure, some desktop apps can be sandboxed. Others don't work without some form of network connection. It's up to the developers what to (not) do here.

> While unfettered access has larger consequences, it is a relatively rare occurrence, whereas unwanted extraction of personal/behavioral information happens continuously.

A website or web app can not access any personal information that you haven't entered into it or its "partners". If cross-site tracking is your concern, there are ways to mitigate that.

Who is this actually useful to though? These sorts of arguments get floated around all the time but the reality has been that digital privacy only draws attention when there's political capital like shaming a company that worked with the opposing party. The mainstream opinion, informed or not, has rapidly shifted towards the belief that after all these data breaches it's a lost cause because the information is already out there in triplicate. Hell, if someone genuinely wants to stalk Joe Random they can just pay give bucks to one of the many websites that compile and sell person searches.

On the other hand, people are scared of 'hackers', who are rarely presented accurately in media, taking control of their devices and spying on them or stealing whatever personal garbage is on their machine.

From that perspective there's almost zero reason to iterate in the direction you've suggested. Especially since, even if you got people to listen, they'll most likely just argue that if Microsoft, Google, Apple (who will probably keep doing their own thing) can't secure their data then no one can.

And from a company perspective this is similarly great, designing for a future where the OS is just a middle-man between the user and the browser means that you have more ability to wall out third parties and users who have problematic update needs/demands suddenly become much less problematic. Sure, the small fry will fight to prevent themselves from getting boxed out and succeed for a time. but you're a Megacorp who has bottomless resources to throw at development, you're looking at the long game. Eventually the cost to compete will simply be too high to be practical and when that happens you have a thoroughly cemented position in the future of the market and all it cost was forming a small alliance with other Megacorps.

Who else is there to object? China rolls their own way, Europe is trying a little but have yet to demonstrate the ability to overcome the obstacles that prevent them from being competitive, and when the American Fed does decide to take an interest it's for wildly exotic problem spaces (looking at you Ghidra and Tor).

Well more and more mobile apps are becoming reskinned webapps. So from a technical standpoint it is becoming more meshed.

That's sort of proves my point. Many apps these days are just a web app with a launcher for your homescreen.

Lets say we have https://dynalist.io/. If you are going to open their web app in Safari and then open their iOS app - you will notice that UI is identical. Because it is the same UI! In one case you have to access it via a browser and the app is just the same frontend delivered to you as an iOS app.

PWA or something similar - is the future. Hence all those APIs in browsers.