Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.

Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.

Your logic just doesn't compute

▲

autoexec 4 hours ago | parent | next [-]

Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.

It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.

	▲	axus 2 hours ago \| parent [-]
		The lawyers should name everyone involved with unauthorized access to your computer as defendants , the obviously innocent parties can be dropped before it gets to trial.

▲

thfuran 4 hours ago | parent | prev | next [-]

I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?

▲

ndriscoll 5 hours ago | parent | prev | next [-]

Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.

▲

dylan604 5 hours ago | parent | next [-]

The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?

I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.

	▲	ndriscoll 5 hours ago \| parent \| next [-]
		The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best. "I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
	▲	alistairSH 3 hours ago \| parent \| prev [-]
		Is a general contractor who subs out the electrical also blame free when the house burns down?

▲

ashf023 4 hours ago | parent | prev [-]

IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault

	▲	ndriscoll 4 hours ago \| parent [-]
		Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too. It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.

▲

mrguyorama 3 hours ago | parent | prev | next [-]

I don't think we should try to split accountability at all here.

The ad platform that allows malware to be served to anyone is at fault.

As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.

▲

DANmode 5 hours ago | parent | prev [-]

> The website didn't server the ad.

Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.

It just makes the decision wildly important.

This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink

Pay attention, do due diligence to do things correctly, or don’t do them.