nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.

What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.

▲

dylan604 3 hours ago | parent | next [-]

Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.

Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.

Your logic just doesn't compute

▲

autoexec an hour ago | parent | next [-]

Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.

It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.

▲

thfuran an hour ago | parent | prev | next [-]

I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?

▲

ndriscoll 3 hours ago | parent | prev | next [-]

Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.

▲

dylan604 2 hours ago | parent | next [-]

The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?

I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.

	▲	alistairSH 10 minutes ago \| parent \| next [-]
		Is a general contractor who subs out the electrical also blame free when the house burns down?
	▲	ndriscoll 2 hours ago \| parent \| prev [-]
		The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best. "I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.

▲

ashf023 an hour ago | parent | prev [-]

IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault

	▲	ndriscoll an hour ago \| parent [-]
		Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too. It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.

▲

DANmode 2 hours ago | parent | prev [-]

> The website didn't server the ad.

Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.

It just makes the decision wildly important.

This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink

Pay attention, do due diligence to do things correctly, or don’t do them.

▲

autoexec an hour ago | parent | prev | next [-]

> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)

Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.

▲

popalchemist 2 hours ago | parent | prev [-]

[dead]