What's neat about this though is it doesn't require any installation. If the Web Push Notifications API has been used properly, it should even support Firefox and IE if/when they support the new API.
Nope. It does use HTML5 service workers, which are sort of like cookies that can run code. But, like cookies, they're limited to actions on the hackernews.onesignal.com domain and they can be removed at any time.
Wow, this sounds wonderful and scary at the same time. This would be an excellent attack vector for running mosquito [0], if you can find the relevant exploits.