Re: Ask my permission
"I cannot see why websites or apps or any other logic running on my device should be able to do *anything* without explicitly asking my permission."
I think the bottom line is that end-users are too stupid to know whether to grant that permission or not.
The fundamental flaw with ActiveX, as originally envisaged, was that you had no control over the code that was running on your machine. Microsoft addressed that by adding a "Do you want this to run?" question and using code signing as a means of helping to answer it. However, in practice most users had no way of knowing whether it was trustworthy or not and simply said "Yes" because otherwise the web-site didn't work.
Java tried to build a sandbox so that there was no need to ask the question. That approach was limited by the fact that a sandbox good enough to keep you safe was also too good to let exciting things happen, so inevitably there came a basket of special permissions that you could grant and web-sites didn't work unless you granted lots of them. Modern-day Android users face the same problem and answer it with the same "Meh, whatever!" response. (Sandboxes also appear to face quality of implementation problems, which is odd because an OS isolates processes in the same way and yet privilege escalation bugs in OSes are quite rate compared to sandbox breakouts.)
Javascript appears to have begun life in a sandbox and is now desparately trying to shake that off to become more ActiveX-like. Quite why programmers are pushing for this is a mystery to me. Of all people, you'd have thought that they would be able to understand the risks and remember the history.
Meanwhile, traditional desktop apps are relatively safe because they tend to come from either people you know and trust or people who have a commercial reputation to lose if they mis-behave. Neither of those constraints applies to "crap slapped on a web page by a third-party ad-slinger".