If the choice is between a webapp and a native app the webapp is going to give users more control and a choice of the platform they want to view it on.

I may be in a minority but I still want to run on desktop linux with an ad blocker or vimium.

Webapps give me that. Native apps don’t.

> the webapp is going to give users more control

You can't modify the webapp nor can you refuse to update it.

Of course you can modify the webapp. You are running the source code in your browser.

Even if it’s minimised you can still modify it.

An ad-blocker in the form of something like a pi-hole should work with native apps, no?

Only when you are connected through your pi-hole.

Also, when pi-hole and mitmproxy are our only options to know what our device is doing and to block things we don't want, then we've lost. The web browser is basically the last bastion of control that we have with its devbar and networkbar and all. Blocking content/requests is something our devices should be able to do themselves.

It's a miracle of history that we have the browser, and it's hard to imagine us having it had it been invented today. We need to fight to keep it, not dismiss it with "ugh web tech amirite?" while we regress to native app black boxes as our only option.

A pi hole protects your whole network. What you are asking for sounds more like a traditional firewall that I think every computer still supports.

No applications installed through the Mac App Store have permission to read your documents unless you explicitly allow that. And you can revoke that access at any time by going to System Preferences… > Security & Privacy > Privacy > Files & Folders.

> They all have permission to upload your entire documents folder to the internet

They do not need to, and unlike "webapps" there isn't a remote server that can change the code that you are running at any moment.

Your response entirely fails to address the parent's concern about security. It's like responding to a RCE in your backend with "yeah it's there but we'll trust the users to not use it"

I do not understand your example. It would not be the user triggering the RCE but rather a 3rd party. In addition I do not see how it fails to address their concern.