4 ms·

I wonder if you could sue a website for serving you malware. Here's my idea for an ad company: * People who want to post ads have to provide their name, addre

I wonder if you could sue a website for serving you malware. Here's my idea for an ad company: * People who want to post ads have to provide their name, address, verified email, and a security deposit(say $500). Larger volumes of ad purchases require either a long history, insurance, or a bank letter to vouch for you. If you load malware anywhere into the system, you get fined and your information gets turned over to the police. * People who want to earn money with advertisements have to provide name, address, verified email, and a security deposit. The security deposit could be funded out of earnings(or not). Fraud is countered by randomly sampling websites and fining offenders if the ad isn't visible. Also they get their information turned over to the police if it was intentional fraud. * Security deposits are returned within 1 month after the advertising relationship is terminated. * Fines are paid out of the security deposit, and your access is restricted until you refill the account(possible with an even bigger deposit). * People who are higher risk(from a shady lawless country, no history or background, etc.) have to pay a higher security deposit. * Ads can be either text or banner ads. Anything Turing-complete needs insurance or a bank letter. * If someone pushes through a porn ad to get advertised on the NYT by miscategorizing it, they get fined. Now all the ads are guaranteed to be of high quality, and the websites you're advertising on are probably higher quality too.

na85 10y ago
Sounds great, here's my deposit paid via bitcoin. My business is at 123 fakenschaft, Zurch. My email is a newly created Gmail account.
- uptown 10y ago
  Your vector of attack doesn't scale very well.
- MichaelBurge 10y ago
  * Require businesses to provide a tax id or registration number appropriate to their country. * Require security deposits to be paid with a bank transfer, cashier's check, or money order from a country with strong anti-money-laundering laws. * For countries like the US where business information is public, verify the provided business address against public records. * Allow larger sites like the NYT to require higher standards of verification(maybe 6 months active history on your account), so even if you went ahead with your malware attacking(say, using a homeless person to shield you from the cops) it at least wouldn't hit the NYT. Honestly, I think at least taking their security deposit would deter a lot of attackers. You're probably right that it wouldn't help much against targeted attacks at smaller sites.
  - evilDagmar 10y ago
    All that would mean is that the malware authors will get paid slightly more for ensuring they have more pernicious and persistent malware. Considering the amount of havok the ransomware guys have been causing lately, do you think they'd really be bothered by being asked to pony up even a $50,000 deposit? The real problem is very simple. The advertising companies need to stop publishing non-vetted media files (which means they can also no longer do a http referral to a site they don't control to save "bandwidth costs"). Many of them are not doing that because they're foolishly assuming a "deposit" or any other such arbitrary monetary penalty is going to be cost-prohibitive to a criminal organization. To the criminal organization, it's no different than any other bribe.
askldfhjkasfhd 10y ago
My understanding of Facebook advertising is that it's somewhat similar to this. I believe you are limited to $500/day budget until you prove yourself a trustworthy partner by building a reputation as such. You do this by running ads over a period of time to establish trustworthiness. It seems to work decently well, for some definition of decent that Facebook has. The point is that it removes the upside for a scammer: low friction entry point (good for scammers!) but limited ceiling: you're not gonna be able to do this to very many people. Remove the incentive by capping the upside, rely on reputation until that point. Feels like a pretty good service.
soared 10y ago
* People who are higher risk(from a shady lawless country, no history or background, etc.) have to pay a higher security deposit That sounds fine initially, but actually think about that for a minute. You want to give 1st world countries and established businesses lower barriers to entry than a random entrepreneur who happens to be from India? Also, AdSense works in a similar manner with the deposits. You don't get a payout until you earn $100. That acts as a buffer for Google to determine whether you are legit or not, and stops people from earning low amounts on lots of different accounts.

na85 10y ago

Sounds great, here's my deposit paid via bitcoin. My business is at 123 fakenschaft, Zurch. My email is a newly created Gmail account.

uptown 10y ago
Your vector of attack doesn't scale very well.
MichaelBurge 10y ago
* Require businesses to provide a tax id or registration number appropriate to their country. * Require security deposits to be paid with a bank transfer, cashier's check, or money order from a country with strong anti-money-laundering laws. * For countries like the US where business information is public, verify the provided business address against public records. * Allow larger sites like the NYT to require higher standards of verification(maybe 6 months active history on your account), so even if you went ahead with your malware attacking(say, using a homeless person to shield you from the cops) it at least wouldn't hit the NYT. Honestly, I think at least taking their security deposit would deter a lot of attackers. You're probably right that it wouldn't help much against targeted attacks at smaller sites.
- evilDagmar 10y ago
  All that would mean is that the malware authors will get paid slightly more for ensuring they have more pernicious and persistent malware. Considering the amount of havok the ransomware guys have been causing lately, do you think they'd really be bothered by being asked to pony up even a $50,000 deposit? The real problem is very simple. The advertising companies need to stop publishing non-vetted media files (which means they can also no longer do a http referral to a site they don't control to save "bandwidth costs"). Many of them are not doing that because they're foolishly assuming a "deposit" or any other such arbitrary monetary penalty is going to be cost-prohibitive to a criminal organization. To the criminal organization, it's no different than any other bribe.

askldfhjkasfhd 10y ago

My understanding of Facebook advertising is that it's somewhat similar to this. I believe you are limited to $500/day budget until you prove yourself a trustworthy partner by building a reputation as such. You do this by running ads over a period of time to establish trustworthiness. It seems to work decently well, for some definition of decent that Facebook has. The point is that it removes the upside for a scammer: low friction entry point (good for scammers!) but limited ceiling: you're not gonna be able to do this to very many people. Remove the incentive by capping the upside, rely on reputation until that point. Feels like a pretty good service.

soared 10y ago

* People who are higher risk(from a shady lawless country, no history or background, etc.) have to pay a higher security deposit That sounds fine initially, but actually think about that for a minute. You want to give 1st world countries and established businesses lower barriers to entry than a random entrepreneur who happens to be from India? Also, AdSense works in a similar manner with the deposits. You don't get a payout until you earn $100. That acts as a buffer for Google to determine whether you are legit or not, and stops people from earning low amounts on lots of different accounts.