> And add jail time to fines. Fines means nothing for the rich.

This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.

I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.

It seems like ads already violate the law via whatever that "unauthorized usage" law is that the government likes to throw around.

Too bad no one has the guts to enforce the law that way.

nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.

What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.

That would mean some google people going to jail...

All ads are malware.

> How is this acceptable for society goes beyond me.

Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.

That's it. That's the entire explanation. It's capitalism and greed.

The default setups are also _crazy_.

So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.

So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.

This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!

Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards

"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"

We should make targeted advertising illegal, full stop. This would remove so many perverse incentives in the system.

This is not the problem. You visiting any website can lead to your computer running the same code.

The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.

I'm not sure you understand what you're asking for, or if you do you have not followed the results of this to its conclusion

Seems like the title was too spicy / people couldn’t behave, post rank obliterated https://news.social-protocols.org/stats?id=50103000

Hope we follow guidelines under this link or “then nobody gets it!”

Keep reading:

https://citizenlab.ca/research/how-discover-tech-turned-targ...

No, they’re using those same techniques,

and they’re just as troublesome as they were before,

to the degree they’re provably being used to decide who to send malicious payloads to…

Zero-click simply highlights if the user needs to actively interact with the malicious payload - or not.

This did get me interested in the specifics of the payload, though:

“It maintains persistence via COM hijacking by overwriting a legitimate COM class registry key’s DLL path with a first-stage DLL dropped in C:\Windows\system32\IME\, and it stores encrypted second-stage payloads in the configuration directory. A signed third-party driver (physmem.sys) enables kernel-level memory access and API call proxying to avoid detection. To preserve system stability, DevilsTongue reinjects the original COM DLL during hijacking, disguising this action through shellcode manipulation of the LoadLibraryExW return value. All additional payloads are decrypted and executed only in memory, allowing the malware to steal credentials from LSASS and browsers, access Signal messages, and use browser cookies to impersonate victims on platforms like Facebook, Gmail, and VK. The malware’s use of scrubbed metadata, encryption, and unique hashes for each file further complicates detection and analysis.”

from https://www.recordedfuture.com/research/tracking-candirus-de...

This was my first question as well. There’s a big gap between “ad network delivers JS” and a zero-click browser exploit. CitizenLab has done some great research including OSINT on the former, but there’s a conspicuous gap between it and the DLL ending up on the victim’s machine.

There are mentions of CVEs in that article with Chrome exploits.

mobile ads can deliver JS-based exploits

I wonder how we're going to unwind this mess in the upcoming years. It seems as if there was a concerted effort to plan this all out before Trump got elected, and then everything fell into place. They obviously have a post Trump plan ready to go. I partially blame the left(really the moderates) in the U.S. For being so unbelievably complacent that it led us to this mess. I just wonder how we're going to unwind this. Nothing lasts forever, but the transition in between states always tends to be disrupting.

Plus a dns based blocker for other apps. Android has an option ready for that, iPhone it will be like VPN.

And wBlock on Safari.

The incentives are lopsided, there’s so much money to be made by selling access to you and your devices, and controlling you, than just taking your money.