10 ms·

It's not that simple. At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. An

It's not that simple. At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. And these all are served in different combinations across several different ad units on multiple pages. And some of those ad sellers may be backfilling with other ad networks, or maybe the publisher is backfilling certain ads from the ad exchanges at certain CPM prices. I'd liken it more to a hardware product being shipped with faulty materials when multiple manufacturers are involved and it's extremely difficult to identify the responsible party. Sure, they're responsible for the end product, but it's not so black and white.

newjersey 10y ago
Whatever the combination, I'll blame the site I visit. I've seen bad ads on imgur one time I used the Internet without blocking ads. The ad just started downloading "Firefox patch" without me clicking anything. It is not black and white but it is pretty close. Edit: I have to give Firefox credit here. It actually just prompted me whether I'd like to save the file. I did and uploaded it to virus total. Probably not a good idea if you do anything sensitive on your computer.
belorn 10y ago
Your description doesn't show why a pharmacist selling illegal drugs is dissimilar to a website selling ad space to illegal ad-space buyers. Any time where you've got multiple producers and multiple retailers, you get middle people like those you describe that must juggle demand and supply. Pharmacists have an equally complex path from producer to customer as ads have from ad-space buyer to website visitor. However, let's instead look at the chain of events: An innocent gets malware from an advertisement. The publisher blames the ad-network who in turn blames the criminal. The ad-network claims that they can't curate the advertisements or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime. An innocent gets mistreated by a fake doctor. The hospital blames the hiring agency, who in turn blames the criminal. The hiring agency claims that they can't do background checks and verify CVs of applicants or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime? Why is there such discrepancy between the two cases? Why can one agency do curation and still function, while the other can't? Why can the publisher get away with using a bad ad-network while a hospital is fully legally responsible for using a bad hiring agency? Those seem to be very simple questions, ones that should have very simple answers.
- toyg 10y ago
  > Why can the publisher get away [...] while a hospital is fully legally responsible The word "legally" gives it away: because there are laws. But we don't like dem laws here on teh intertubes, so far-west it is.
  - tomp 10y ago
    There are laws agains hacking though. If I visit a website and the website willfully (i.e. it wasn't hacked) serves me malware... that sounds like hacking!
- chris_wot 10y ago
  I'm not aware of any legal action taken over malware served up from add on a website. But if it were to happen, the website is who is sue, because it is within their responsibility to ensure that ads and/or content should not cause harm to a visitor.
  - ryan-c 10y ago
    > it is within their (the website) responsibility to ensure that ads and/or content should not cause harm to a visitor. I don't think that's been established. With the current state of advertising on the internet, it's not even possible to do this. In general, websites use advertising networks which do not allow them to proactively vet the content. Even if they did, no amount of vetting can guarantee the content is benign (active content can do naughty things only some of the time or on some platforms, or things not yet recognized as naughty - this is also why antivirus isn't reliable). So, clearly the solution is to not allow Javascript or flash, right? Nope - exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. This could maybe be dealt with by contracts between websites and advertising networks specifying that the advertising network will be liable for malicious content, but I don't see that happening.
    - Dylan16807 10y ago
      >exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. Exploits in jpg/png are very rare. At worst, all you have to do is make the ad network [re]compress the image.
claudius 10y ago
It absolutely is so black and white. If I buy a computer from you and you send me a parcel which explodes in my hands, no amount of hand-waving is going to get you out of this -- this even holds if you just distributed notes "Call this number to get your own personal computer free of charge!". And just as a computer reseller/free-computers-for-everyone-distributor has an obligation not to send bombs to people who asked for computers, a website owner has an obligation not to serve malware to people who asked for content.
- iopq 10y ago
  If I sell you a computer and it has adware on it, we just call that "normal state of affairs" because OEMs have been putting adware and shit on their computers for decades.
devishard 10y ago
> At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. And these all are served in different combinations across several different ad units on multiple pages. And some of those ad sellers may be backfilling with other ad networks, or maybe the publisher is backfilling certain ads from the ad exchanges at certain CPM prices. So, don't do that. > It's not that simple. It is absolutely that simple. Your argument is basically, "Their process is so complicated they can't avoid serving up malware." But that's not a justification for serving up malware. If your process is too complicated to avoid serving malware, then you need to simplify your process until you can avoid serving up malware. You don't get a free pass on ethics just because ethics are inconvenient for your business model.
- Dylan16807 10y ago
  Especially when an ad network that only serves images is easier to make than one that can serve scripts and sometimes attack the user.
- Silhouette 10y ago
  You don't get a free pass on ethics just because ethics are inconvenient for your business model. I think calling this an ethical issue is quite a stretch. In many cases, we're talking about visitors who are not only enjoying the content from someone else's site completely for free, but also employing tools that actively modify the intended presentation of that content to the detriment of the host site's operators. And now you're saying that not only should the site operators make their content freely available and accept that some visitors will circumvent possibly the only way they have of generating revenue, those operators should also be actively responsible for vetting any third party content they incorporate within their site in case the third party is hostile and those visitors know enough to run ad-blockers but not enough to run anti-virus software? That seems a very short-sighted and one-sided position, entirely in favour of the party who isn't actually contributing anything in this scenario, and I see no ethical basis for that. Edit: For those who are downvoting, please consider that I did not disagree with the original premise I quoted. Obviously unethical business models are still unethical even if the ethical ones are inconvenient. What I'm asking is why we should consider it an ethical requirement for someone who is already generously offering their content for free and accepting that a significant fraction of visitors will circumvent their intended ad-funded model to also go to unrealistic lengths to vet any third party content they include for safety against arbitrary unknown threats that could change at any time without notice, all for the benefit of a visitor who is offering them nothing. I'm not sure whether someone operating a web site really owes their visitors anything in this scenario, other than perhaps a basic "good citizen" principle of not negligently serving up malicious content, and I don't see how operating within the same infrastructure as a huge number of other web sites could reasonably be considered negligent in this respect. Unless you think we should also close down all third party CDNs, image hosting services, caching services, web font services, and so on, the web is fundamentally a linked medium where sites can usefully be built by combining resources from other services, and naturally those other services will retain control of what they are hosting themselves. Making Joe Blogger responsible if some massive service's CDN version of jQuery got hacked doesn't seem like a good way to encourage Joe Blogger to spend their time sharing their writing with the rest of the world.

newjersey 10y ago

Whatever the combination, I'll blame the site I visit. I've seen bad ads on imgur one time I used the Internet without blocking ads. The ad just started downloading "Firefox patch" without me clicking anything. It is not black and white but it is pretty close. Edit: I have to give Firefox credit here. It actually just prompted me whether I'd like to save the file. I did and uploaded it to virus total. Probably not a good idea if you do anything sensitive on your computer.

belorn 10y ago

Your description doesn't show why a pharmacist selling illegal drugs is dissimilar to a website selling ad space to illegal ad-space buyers. Any time where you've got multiple producers and multiple retailers, you get middle people like those you describe that must juggle demand and supply. Pharmacists have an equally complex path from producer to customer as ads have from ad-space buyer to website visitor. However, let's instead look at the chain of events: An innocent gets malware from an advertisement. The publisher blames the ad-network who in turn blames the criminal. The ad-network claims that they can't curate the advertisements or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime. An innocent gets mistreated by a fake doctor. The hospital blames the hiring agency, who in turn blames the criminal. The hiring agency claims that they can't do background checks and verify CVs of applicants or the margins becomes to small. In the end, the innocent has to take the full fallout of the crime? Why is there such discrepancy between the two cases? Why can one agency do curation and still function, while the other can't? Why can the publisher get away with using a bad ad-network while a hospital is fully legally responsible for using a bad hiring agency? Those seem to be very simple questions, ones that should have very simple answers.

toyg 10y ago
> Why can the publisher get away [...] while a hospital is fully legally responsible The word "legally" gives it away: because there are laws. But we don't like dem laws here on teh intertubes, so far-west it is.
- tomp 10y ago
  There are laws agains hacking though. If I visit a website and the website willfully (i.e. it wasn't hacked) serves me malware... that sounds like hacking!
chris_wot 10y ago
I'm not aware of any legal action taken over malware served up from add on a website. But if it were to happen, the website is who is sue, because it is within their responsibility to ensure that ads and/or content should not cause harm to a visitor.
- ryan-c 10y ago
  > it is within their (the website) responsibility to ensure that ads and/or content should not cause harm to a visitor. I don't think that's been established. With the current state of advertising on the internet, it's not even possible to do this. In general, websites use advertising networks which do not allow them to proactively vet the content. Even if they did, no amount of vetting can guarantee the content is benign (active content can do naughty things only some of the time or on some platforms, or things not yet recognized as naughty - this is also why antivirus isn't reliable). So, clearly the solution is to not allow Javascript or flash, right? Nope - exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. This could maybe be dealt with by contracts between websites and advertising networks specifying that the advertising network will be liable for malicious content, but I don't see that happening.
  - Dylan16807 10y ago
    >exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. Exploits in jpg/png are very rare. At worst, all you have to do is make the ad network [re]compress the image.

claudius 10y ago

It absolutely is so black and white. If I buy a computer from you and you send me a parcel which explodes in my hands, no amount of hand-waving is going to get you out of this -- this even holds if you just distributed notes "Call this number to get your own personal computer free of charge!". And just as a computer reseller/free-computers-for-everyone-distributor has an obligation not to send bombs to people who asked for computers, a website owner has an obligation not to serve malware to people who asked for content.

iopq 10y ago
If I sell you a computer and it has adware on it, we just call that "normal state of affairs" because OEMs have been putting adware and shit on their computers for decades.

devishard 10y ago

> At any one time, a publisher can be serving ads from a few exchanges, a few different private sellers, and custom built ads for brands. And these all are served in different combinations across several different ad units on multiple pages. And some of those ad sellers may be backfilling with other ad networks, or maybe the publisher is backfilling certain ads from the ad exchanges at certain CPM prices. So, don't do that. > It's not that simple. It is absolutely that simple. Your argument is basically, "Their process is so complicated they can't avoid serving up malware." But that's not a justification for serving up malware. If your process is too complicated to avoid serving malware, then you need to simplify your process until you can avoid serving up malware. You don't get a free pass on ethics just because ethics are inconvenient for your business model.

Dylan16807 10y ago
Especially when an ad network that only serves images is easier to make than one that can serve scripts and sometimes attack the user.
Silhouette 10y ago
You don't get a free pass on ethics just because ethics are inconvenient for your business model. I think calling this an ethical issue is quite a stretch. In many cases, we're talking about visitors who are not only enjoying the content from someone else's site completely for free, but also employing tools that actively modify the intended presentation of that content to the detriment of the host site's operators. And now you're saying that not only should the site operators make their content freely available and accept that some visitors will circumvent possibly the only way they have of generating revenue, those operators should also be actively responsible for vetting any third party content they incorporate within their site in case the third party is hostile and those visitors know enough to run ad-blockers but not enough to run anti-virus software? That seems a very short-sighted and one-sided position, entirely in favour of the party who isn't actually contributing anything in this scenario, and I see no ethical basis for that. Edit: For those who are downvoting, please consider that I did not disagree with the original premise I quoted. Obviously unethical business models are still unethical even if the ethical ones are inconvenient. What I'm asking is why we should consider it an ethical requirement for someone who is already generously offering their content for free and accepting that a significant fraction of visitors will circumvent their intended ad-funded model to also go to unrealistic lengths to vet any third party content they include for safety against arbitrary unknown threats that could change at any time without notice, all for the benefit of a visitor who is offering them nothing. I'm not sure whether someone operating a web site really owes their visitors anything in this scenario, other than perhaps a basic "good citizen" principle of not negligently serving up malicious content, and I don't see how operating within the same infrastructure as a huge number of other web sites could reasonably be considered negligent in this respect. Unless you think we should also close down all third party CDNs, image hosting services, caching services, web font services, and so on, the web is fundamentally a linked medium where sites can usefully be built by combining resources from other services, and naturally those other services will retain control of what they are hosting themselves. Making Joe Blogger responsible if some massive service's CDN version of jQuery got hacked doesn't seem like a good way to encourage Joe Blogger to spend their time sharing their writing with the rest of the world.