Comment by JumpCrisscross
3 days ago
> There is no such thing as "ad provider."
If a website serves me malware, the website's owner should be liable to me. They may then be able to sue someone else, in turn. But I chose to interact with them and then they chose to outsource stuff to crooks.
This would be complicated to implement. But it's absolutely doable.
No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.
Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?
Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
> It completely upsets the economics of content management
Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".
Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).
The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.
But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.
How can you exercise situational awareness against a zero-day attack?
There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.
> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads
Why? An insurance product wouldn't wipe out ad revenues.
> this is not much different from "regular" crime. It happens
Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.
> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness
Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.
What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.
As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.
> No ad revenue would be worth such liability
And this would motivate fundamental change in the industry to be able to track down the bad actors.
KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.
> be mindful and exercise situational awareness
I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.
Might as well say: don't use the internet. That might actually be the best advice to come from all this.
So you're saying we're all fucked and there's nothing we can do?
I think we currently are - but not because of online ads. :-)
My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.
2 replies →