EDIT: Nevermind, I'm abandoning this part of the thread. Your other comment where you suggest concrete improvements to the web's permissions and security model is proving to be a far more productive line of conversation. You can just ignore the rest of this comment if you want.

> However it seems pointless me going into the finer details given you've already dismissed it out of hand

I haven't dismissed it, that's why I _asked_ whether or not it only controls network access. Does it? You mentioned other related products that offer features similar to "your typical modern AV suite", but I've never seen an AV suite that offered any sort of fine-grained control over application permissions before; certainly not to the extent that the web or even mobile OSs do. Control over network access, no matter how advanced, is not sufficient to constitute a "robust permission system".

> Once again you're grouping the multiple different permissions models of the web into one entity.

I'm not referring to extensions here. The ability to disable JS, sound, Flash, images, third-party cookies, etc, is built into modern browsers. chrome://settings/content

> the permission model of the web allows far more bad behaviour than any other security model I've worked with in the last 20 years

Give me an example. Again, vulnerabilities like XSS don't count; only permissions.

> You've yet to example another system that is worse than the one you're claiming king

I can name plenty. Windows, Linux, and Mac all allow apps full access to every file on the hard drive owned by the user by default. It's hard to get much worse than that.

> yet I've exmapled plenty which are better.

No you haven't. You named Zone Alarm (which is still under discussion), Firewalls (which only control network access), SELinux (which is way too hard for the average user to use), and iOS (which is very close to the level of the web, but still not quite as flexible).

> it's only a security vulnerability because the security model of the web allows cross site scripting by default

This is like saying "RCE is only a vulnerability because the security model of Linux allows buffer overflows by default". First, it has nothing to do with permissions. Second, it's attributing a vulnerability in a third party application to the platform rather than the application. Third, the web does _not_ allow "Cross Site Scripting" by default. Are you familiar with how XSS works?

> Even my most platform agnostic solution is riddled with easy workarounds. It's like how it has become an impossible job to reliably detect new malware threats so instead AVs just add new signatures to their databases as quickly as they can (I know I'm overly simplifying things to make a point - but you seem to think you can reliably control what data gets leaked on the web and quite clearly that's bullshit)

You're right, it's not reliable. That's why it's not part of the web permissions model. But it's still far more control than any other platform gives you, which is the point I'm trying to make.

> The web gives you literally zero additional options that the host OS of any given platform - or the wider infrastructure you're connected to - also offers.

Counterexamples: uMatrix, Privacy Badger, Tor Browser.

> I guess it depends if you're talking about "robust permissions system" in the UNIX sense (ie this tool does one thing and does it well) or if you're specifically thinking about application sandboxing.

Clearly the latter, as we're talking about consumer software platforms here (the web), not isolated tools.