undefined

points

[-]

The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?

I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.

by ndriscoll5 hours ago|

parent|

[-]

The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best.

"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.

by alistairSH3 hours ago|

parent|

prev|

[-]

Is a general contractor who subs out the electrical also blame free when the house burns down?

by ashf0235 hours ago|

prev|

[-]

IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault

by ndriscoll4 hours ago|

parent|

[-]

Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too.

It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.