Yahoo bears some, but not all, responsibility. As for version blocking you are correct that that falls entirely on Adobe and the browser. One of the most diff

Yahoo bears some, but not all, responsibility. As for version blocking you are correct that that falls entirely on Adobe and the browser. One of the most difficult parts of an attack like this is to get people to actually "run" the malicious code. In this case that meant loading some flash object. Embedding malicious flash is one of the easiest ways to get a person to run your code, but you need a popular site to do anything large scale. Yahoo is responsible in that they own a vector (their ad network paired with their popular web properties) that makes this large scale distribution trivially simple for the attacker. Content providers (web property owners) should be responsible for the ads that get served on their site but, given how the ecosystem has evolved, they have very little control. The most a content creator can do is switch to a different ad network. This case is interesting because the ad network and the content property were owned by the same entity; switching networks makes no sense. The quality/safety of ads is left up to the network and the ad creators. Obviously the creators cannot be trusted. The network has little incentive to police thoroughly (although it seems like Yahoo did take some action in this case). There is such a glut of ad real estate that individual content creators have effectively zero power to affect change. If one of the networks strove to promise a better experience for the content providers (and us; the ultimate consumer) it could cause content providers to switch networks. But that costs money and no ad network has the incentive to be first. They simply don't need to in order to continue being competitive. It will be interesting to see what happens in the next few years. It seems like companies (Apple in particular) are starting to try to gobble up as much content as possible. If enough providers sign on to such programs, these "co-ops" could have significant bargaining power with regards to the ad networks. But who knows what other issues will crop up. Today everybody has a website or a blog that they need to independently monetize via ads. Grouping together under the banner of a large company could work well for them, or they could effectively become web serfs. It'll be interesting to see either way.