I agree with you completely.

The web became an OS because there's a huge demand for cross-platform zero-install software applications that run in a sandbox without dangerous user level access to your machine.

And if you do need dangerous user or system level access there is always Flash and its everpresent zero days.

sure there are no browser exploits at all ...

Top 50 Products By Total Number Of "Distinct" Vulnerabilities http://www.cvedetails.com/top-50-products.php

#3 Firefox

#4 Chrome

#7 Internet Explorer

Given the context of the thread, it's remiss of you not to include some more context:

#1 OS X

#2 Linux

#5 iPhone OS

#6 Flash

#8 Debian Linux

#9 Windows XP

#10 Windows Server 2008

Which is to say that, except for Flash, all of the top 10 products are browsers or OSes.

On the other hand, looking at the full list, I'm not so sure I trust the data curation. The JRE and JDK are each listed twice (because Oracle bought out Sun), and Internet Explorer and IE are two separate listings.

Yes. A web browser is a VM for executing untrusted code. That is its truly unique feature. Understand that and a lot of other things become clear.

That isn't _its_ feature. It belongs in a web browser as much as it belongs in Adobe Acrobat (although you could consider that a VM for executing untrusted code, too -- heoh!)

If you want a VM for executing untrusted code, use a VM for untrusted code, don't shoehorn it into HTML, or PDF, or whatever. That makes zero sense.

You appear to be conflating a relatively uncommon personal belief with the natural order of things. There is a small subset of people who believe electronic documents should be limited to what's possible with paper with the addition of links, but the vast majority of users and implementers want features which are only possible with interactivity. Once that's the case, you're talking untrusted code execution and it absolutely has to be integrated because much of the value comes from working with the document rather than just linking to a separate program.

PDF is a special case since there's similarly a considerable value in having things like forms, equations, graphs/illustrations, etc. being interactive but since Adobe has a stranglehold on the format, it was characteristically poorly designed, badly implemented, effectively unsupported, and you had to pay to use it. I would not draw conclusions from this other than avoiding Adobe-encumbered ideas.

The other side of this position is forgetting how important network effects are. People did try to implement purer alternatives but they were always hindered by the need to deploy them first. The low-friction web model is extremely popular with users and any question of replacements or alternatives needs to fit into the gradual upgrade model of the web unless you can get Microsoft and Apple to ship it in the OS.

There is also pain to test web apps for numerous browsers (so much fun on mobile)

in term of security, popular browsers are in the top 10 of most exploited software

so yeah the delivery model is nice, the update model too, but still I'm not convinced that the web model for apps is the "end all, be all" of app development

I could even argue that more and more apps are coming back to native, first instigated by the mobile app stores, which then expanded to the desktop app stores.

There is room for everyone, web apps and native apps, but still I would not want to use something like gmail as a browser app on my mobile.

I fear that the "instant" distribution and update via the net has resulted in sloppy programmers. This because they can always just push a fix by hitting a few keys.