On Android, you even have f-droid, an entire alternative app store that only accepts open-source, user centric apps!

That depends on the implementation, but its just a fundamental technology difference. On the web, the default way to do things is to use a bunch of HTML elements and whatnot, which are user-agent-introspectable, even if they are modified using a blob of code.

With apps, you kind of by definition only have a blob of code. As an user and with a sufficiently advanced operating system, you can block some outside-world interactions like internet connections, but the app only has to give you a render target whose pixels can be drawn to arbitrarily. Some apps even use integrity verification features from the OS vendor to check if they haven't been tampered with, that is much harder to do on the web.

Which is incidentally why there is so much interest in high performance web programming and being able to draw arbitrary pixels to a render target (hello canvas/webgl/webgpu). Expect content blockers to become way less effective in the coming years (even ignoring the big obvious attacks like Chrome's Manifest v3).

> Expect content blockers to become way less effective in the coming years

That's s very sad and probably very accurate analysis!

Wonder if the arms-race will give rise to other kinds of add blockers that use image recognition to identify ads. But that still requires rendering the ads (even if only in the background), removing much of the benefit of ad-blockers.

I suspect some might be able to rise up by injecting themselves at framework level, since it's very likely that the programs will still keep some sort of in-memory representation. Though I don't think that injecting code into other WebAssembly blobs is possible with the security models we have today.

The surefire way would be an external application that uses OS APIs to fiddle with memory directly (bye bye mobile content blockers).

But whatever form it takes, it would have to be programmed to operate on every framework available, so it's way less universal than writing a CSS selector or URL regex.

I would still say that even FOSS apps off F-Droid are less user-centric than the web. They're more likely to respect the user, for sure, than even most web apps. And a user who is comfortable with code can always fork them and customize them. But the barrier to entry for a custom experience is much higher on an app than it is on the web. Browser extensions are highly accessible to many people and can allow tweaking the experience beyond what the developer natively enabled.

As a simple example: Dark Reader has 5 million installs on Chrome. That's 5 million people who can view a web app in dark mode even if the developers didn't think to provide a native way to do so.

My thoughts exactly. I do lots of "tinkering" with my web experience and have a few open source apps that I build and install, and the barrier of entry on apps is way higher than for websites. Even for an app that is open and friendly, it's still a major undertaking to get a dev env setup and debug/tinker. And once you do, auditing the app to see what it does is further difficult. With the web you don't even need a dev env, and an extension like uMatrix makes it pretty easy to audit the site and see what it's doing/loading.

I'm to the point where I boycott apps. I will only use an app if there's a real benefit to me for doing so, such as podcasts and music and offline functionality or those that use hardware features.