What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.
"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.
It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)
Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.
Too bad no one has the guts to enforce the law that way.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.