>>The browser remains a huge kluge, but Amazon, Facebook, et al are making billions with it, so there must be a way to deal with it.

They're both promoting mobile apps. They all are, often exposing function you don't get by browser. Most recently Expedia offered mobile app rates substantially lower than browser and Amazon offers $10 credits to move to the app. Why, if browser is so fab?! ;-)

>>I bit the bullet a few years ago and developed some apps in PHP/MYSQL and the clients love them.

We've done both NET and LAMP apps but my concern is the same one that tripped up Equifax- vulnerability via a 3rd-party clever bit to try to mimic normal Windows functionality. Another example is official CERT advice not to use Netgear routers after a massive exploit was discovered in their PHP portal, allowing total control over the router. IMHO there's too many moving parts leaving a massive risk with too many companies spared the torment of breach by good fortune rather than good planning. Of course you can protect via VPN as Victor asserts, but if you can access their login there's a good chance the VPN credentials are saved so you can pierce the protection and access the exploit.

>>The app approach is structurally flawed by the intermediation of the app store, which adds cost/complexity and no value.

RDS is just one app, after which- you can do it all. ;-)