Comment by Frieren
4 days ago
Ads providers should be held responsible for delivering malware. All the tracking (that includes fingerprinting for clients that do not want to be tracked) should also be illegal.
How is this acceptable for society goes beyond me. And then corporations blame individuals when they get scammed. It is your fault that we have all your information and leak it everywhere, when it is not just directly sold.
And add jail time to fines. Fines means nothing for the rich.
I think it would be nice for them to be held accountable but I get the feeling this is part of a wider nation state intelligence apparatus and I doubt that they will hold themselves accountable.
The default setups are also _crazy_.
So you search for company A wanting to buy their product. You check out. Basically every setup I've audited has every tracking product ever for everything.
So you buy X, and the company sends that purchase event with your information to Meta, Google, TikTok, Applovin, Klaviyo, and 10 others.
This idea is hopelessly entrenched in every marketing department, who has leadership's ear: We HAVE to send EVERYTHING to EVERYONE otherwise our ROAS will go DOWN!
Every platform works this way, they're all set up to put giant red banners on your marketer's dashboards
"You could be getting 50% better results if you sent <customer_2nd_grade_report_card>!"
Its basically how all the ad platforms fundamentally work: they use conversion events to train their ad algorithms.
nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.
What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.
Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.
1 reply →
I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?
Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.
5 replies →
> The website didn't server the ad.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
I don't think we should try to split accountability at all here.
The ad platform that allows malware to be served to anyone is at fault.
As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.
You're wrong on legislating these things. If the ad network is forced into KYC for their ad distributions and they are excluded from safe harbor, like a TV network would be, then I guarantee those ads cease to exist.
This mentality of "it's to hard" doesn't get things done.
I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.
> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).
Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)
Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.
[dead]
This is not the problem. You visiting any website can lead to your computer running the same code.
The main problem is that the exploits from js to code execution or data exfil are possible in the first place. The issue is that you have JS, which is generally pretty isolated, able to talk to bundled libraries (like libwebrtc), which often contain the exploits and share the same memory space. There needs to be a intermediate layer between JS talking to any such library, like process isolation with IPC for communication.
Sure, but there's a big difference between going to a sketchy, malicious site vs a reputable site that does serve ads and now being at the mercy of any arbitrary crap in the ad you didn't choose to see
We should make targeted advertising illegal, full stop. This would remove so many perverse incentives in the system.
It seems like ads already violate the law via whatever that "unauthorized usage" law is that the government likes to throw around.
Too bad no one has the guts to enforce the law that way.
That would mean some google people going to jail...
If such a thing were passed, it can't apply retroactively. But yes, google people would go to jail when they inevitably flout it as they are accustomed to doing. We should make this happen.
People in the US have a unique window of opportunity starting TODAY (Oct 2026) in many places with early voting. I implore everyone who is able to vote in the midterms to do so.
Which candidates support the "put ads providers in jail" platform?
3 replies →
Stop, stop, I can only dream so hard.
All ads are malware.
And all spyware is "mercenary" spyware, at least in the sense that the creators only care about money and are willing to hurt others to get it.
> And add jail time to fines. Fines means nothing for the rich.
This, pretty much. Money removes consequence form your actions. If every time you screwed up, instead of being fined you had to wear a silly hat, go on TV and apologize, or get some time behind bars, even if it were 1 or 2 days it would be very effective.
I'm not sure you understand what you're asking for, or if you do you have not followed the results of this to its conclusion
This comment is meaningless without stating the unintended consequence you believe you’ve identified.
> How is this acceptable for society goes beyond me.
Easy, when your society glorifies and deifies greed, you can excuse literally any act so long as it makes enough money.
That's it. That's the entire explanation. It's capitalism and greed.
> That's the entire explanation.
Not quite. Most people in society are completely oblivious to this happening. And their lack of awareness is why the exploiters don't face more public opposition.
That's true, even what they know is happening is so abstract and hidden that they don't really understand it.
Vast majority of people will gladly sell their privacy.