Isn't it more a question of how much of your computer you are willing to expose without explicitly authorizing it? As long as webapps don't demand much, you let them bypass explicit installation. Even Gmail 'installs' something to run locally according to some broad interpretation of the term. The difference between that and signed oneClick type installs with auto update from a trusted source is pretty slim.

I just can't help but think that for webapps to get fundamentally richer, they are going to need increasing access to client resources, such as the ability to communicate with each other across process boundaries. At that point, security concerns will probably dictate a somewhat more formal installation process for them as well.

I wonder if it's that you have to install anything, or if it's just a "click cost" -- for every extra click you ask of the user, you lose potential customers?

Kind of the same thing that we see in web sign-up forms where for every extra piece of information you ask, a huge number of potential users drop off.

thank you