Hacker News Reader

Comment by ticulatedspline | Hacker News Reader

nah, you'll never get there that way. Even if there was willpower to do it legislating these things is too hard.

What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

If they win the landscape will change. It would set a precedent for civil liability for infecting your users even when it's not your content directly. That would likely spook the shit out of the market, security becomes a feature.

View on HN

Why the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.

Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.

Your logic just doesn't compute

Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.

It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.

The lawyers should name everyone involved with unauthorized access to your computer as defendants , the obviously innocent parties can be dropped before it gets to trial.

I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?

Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.

The website is signing up for a service. You could say that a website continuing to use the service of a known malicious ad provider is problematic, but are there any ad providers known to have not served malicious something?

I think you're also confusing multiple malicious activities occurring on the web. Data harvesting is another thing that needs to be banned into oblivion. Rarely are sites doing that natively. It is being done as a second part of service the site wants. A site/app wants naturally wants to seen analytics about how visitors are using the site/app, so they include some third party tool that provides that data to an extent at the cost of collecting/keeping that data for their own use. Want to make it easy for users to interact with social platforms regarding your site/app, they now get to collect/keep that data. That's a different thing than being served malicious ads.

The website is partnering with another business, often as their primary or only means of revenue. That is their entire business. This is not you signing up for a service like Netflix. It is a B2B partnership, and in fact, if you look at the direction money is flowing, they're the ones selling the service (surreptitious access to users' computers). It is their responsibility to choose their business partners and what ads they'd be running. If they're not doing any examination of what they're inflicting on their users, and just letting whomever's buying send whatever payloads they'd like, then yeah that's negligent at best.

"I'll pay you if you run this software on your visitors' computers without asking questions" is not a "service" you sign up for. People don't pay you as a service. That's about as shady a deal as it sounds.

Is a general contractor who subs out the electrical also blame free when the house burns down?

IMO the ad provider is fully at fault for allowing script tags and other potentially vulnerable features in ads. Why can't the ads just be static? I mean I get why they want it, but it should not be allowed, and IMO that's where the ad provider is almost fully at fault

Websites can set CSP to not allow ad providers to serve scripts. They're the ones adding those scripts to their page, and are equally at fault. Though static ads can still point people into a fraud pipeline, and websites running those ads should be held accountable for that too.

It's fully possible to individually negotiate with someone that wants to publish an ad on your site. If you choose to take money from literally anyone who wants to do so, then why would you not be accountable when they inevitably use you to target users for fraud? You chose to take their money and not even look at what you were publishing.

> The website didn't server the ad.

Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.

It just makes the decision wildly important.

This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink

Pay attention, do due diligence to do things correctly, or don’t do them.

I don't think we should try to split accountability at all here.

The ad platform that allows malware to be served to anyone is at fault.

As is the individual website that has selected to allow a 3rd party's code to be delivered to your machine without controlling that risk, often for very silly reasons.

You're wrong on legislating these things. If the ad network is forced into KYC for their ad distributions and they are excluded from safe harbor, like a TV network would be, then I guarantee those ads cease to exist.

This mentality of "it's to hard" doesn't get things done.

I do agree that some greedy lawyers and civil liability would solve this, but that's not a long term solution at all.

> What we need is some greedy lawyers and civil liability. Find a campaign that infected enough individuals, fire up a class-action lawsuit against the website on which the ads where actually shown (not the ad provider).

Laughable. As countless class action lawsuits have demonstrated the victims are never made whole (https://instituteforlegalreform.com/wp-content/uploads/2020/...), the criminals get a slap on the wrist fine that is a tiny fraction of the profit they made doing crime, and the lawyers walk away with pockets filled with cash while nothing changes. (https://link.springer.com/article/10.1007/s10611-024-10170-w)

Fine's and class action lawsuits don't work. Throw some CEOs in jail and things will actually change.

Reply on news.ycombinator.com