Who manages those permissions? The browser? The OS? Is it different dialogs than the OS? If not, you are now giving a browser the ability to delegate those permissions. Is it the same level of granularity?

If I visit one page, say facebook and it gets permission. And then visit another page which embeds Facebook, does it still have all those permissions there? If I visit a page, and it hits 60 different URLs under the hood am I getting 60 accept buttons or blanket accepting all of them?

As I see it, there is a ton of difference in scope there.

The exact same argument exists for apps that embed facebook's SDK in them.

It isn't like we can't treat a WASM compiled program delivered through https the same as any other compiled program delivered through an app store. It is just that launching involves visiting a url instead of tapping an icon.

Sure, but this ignores the fact that App Store apps are reviewed, and Websites are not.

That’s critical to why one is trusted more than the other.

As to the Facebook SDK, yes that’s a problem, but it just proves the point - Apple is in fact continuing to tighten restrictions on what Facebook can do to invade your privacy via their app.

This is only possible because it’s an App and not a website.

I was thinking more about my post after I made it, and I came to the same realization.

Part of this is on iOS, apps are compiled to native code and the restrictions enforced through static analysis before code even reaches the end user.

A good analogy would be Android and how they ban 3rd party advertisements in push notifications. That obviously isn't an API enforcement, indeed that enforcement is only possible with a centralized app store where developer credentials can be revoked.

In comparison, web browsers have become a push notification nightmare, with naive end users being endlessly spammed with garbage on their desktop being delivered through web push notifications.

So, I'll readily concede that a web based open distribution model cannot offer the same API surface area as a distribution model that has a combination of manual reviews and static code analysis being used to enforce customer friendly policies.

That said, a lot of apps still can fit into the web model, including large numbers of games (See: The decades of insanely HQ Flash games that existed until recently, sandboxed(ish) code delivered through a web browser), video playback (in which downloaded apps failed in the 90s, then the field took off thanks to web browsers), music playback (I use Spotify in my browser every day), and many others.

Sure, I don’t think anyone, least of all Apple, is disputing that the web can be a great platform for apps.

The point is that there is a genuine need for both kinds of platform and for people to be able to tell the difference.

Can’t believe people downvoted you for making a clear point

And the same sandboxing.