Hacker News Reader

Comment by Postosuchus | Hacker News Reader

No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.

Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?

Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.

View on HN

> It completely upsets the economics of content management

Exactly. It moves the economic incentives from "serve the ads from the highest bidder and turn a blind eye to the fact that that's a scammer/malware" to "drop an ad platform that can't or won't keep the scammers/malware out".

Or even better, refusing to use ad platforms that let the ads serve arbitrary code. There is no strict reason why an ad can't be an image (re-rendered by the platform) and a link. Slapping scripts all over the place just makes it easier to collect data (among other things to verify that all the companies involved in serving your ad aren't cheating you, because the ecosystem is full of scammers in all directions).

The deterrent here would be prosecuting the accomplices involved in, and directly getting paid for, the crime.

But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.

How can you exercise situational awareness against a zero-day attack?

There are several parties who have an opportunity to detect that problem before it causes serious damage to people visiting a website. The visitors themselves are not among them. Trying to make those visitors responsible for the consequences is nonsensical.

> completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads

Why? An insurance product wouldn't wipe out ad revenues.

> this is not much different from "regular" crime. It happens

Why do you think parking lots have signs that say they aren't responsible for goods stolen out of cars parked there? Because that liability, by default, exists. And if a parking lot is a robbery hotspot, and the owners don't bother putting up cameras or whatnot, they'll absolutely start facing lawsuits and investigations.

> it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness

Nobody argued as much. That doesn't mean we give negligent actors monetizing malware a free pass.

What, your ad provider would just need to indemnify you for the consequences of their own fuckups. This is pretty basic stuff.

As for the ad provider, it is trivial to not deliver criminal payloads if your business starts from the assumption that doing so is costly instead of something you can foist on society for your own benefit.

> No ad revenue would be worth such liability

And this would motivate fundamental change in the industry to be able to track down the bad actors.

KYC exists for various industries in order to track down the person responsible for bad actions. Implement KYC for the advertising chain, or something equivalent, to ensure there's a validly registered sue-able entity at the end of it.

> be mindful and exercise situational awareness

I'm not going to say victim blaming, but a good percentage of the population just aren't capable of this, especially with "the sheer scale" of advertising they're exposed to. It's exhausting to be on guard for the entirety of your life.

Might as well say: don't use the internet. That might actually be the best advice to come from all this.

So you're saying we're all fucked and there's nothing we can do?

I think we currently are - but not because of online ads. :-)

My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.

I think I've sent this template before:

"But not because of <industry I am employed by>"

"in-part because of ads" seems more reasonable, tbh.

When I worked at an adtech company almost ten years ago, this sort of shit was the exact concern of me and my colleagues. We've had time to do better but guess we're just fucked.

Reply on news.ycombinator.com