alt Hacker NewsWhy the website instead of the ad provider? The website didn't server the ad. The ad provider did and should be the responsible part to ensure what it provides is not malicious.
Attacking a single website does nothing. If you bankrupt the site, there are millions more sites. If you attack the ad provider, bankrupting it, and shutting it down, millions of sites are now protected.
Your logic just doesn't compute
Replies
I don't understand how you could arrive at this perspective. If you're doing business with ExampleCorp and one of their subcontractors malfeasantly mishandles things, would you say that ExampleCorp had nothing to do with it? If not, why does that change when the interaction happens via example.com?
Seems to me the website is negligent and the ad provider is an accessory (e.g. helping to select targets for fraud), at the very least.
> The website didn't server the ad.
Sure it did. The content coming from elsewhere doesn’t change their decision to include it when the user loads their page.
It just makes the decision wildly important.
This is no different than the “I’m too big, can’t tell what my subsidiaries are doing!” wink
Pay attention, do due diligence to do things correctly, or don’t do them.
Ideally, you'd sue the website because the website is responsible for everything that shows up on the website they control, and the website would turn around and sue their ad provider because they paid that ad provider for a service that wasn't malware delivery and as a result of that ad provider's crimes (or negligence) the website now has legal costs and harm to their reputation.
It shouldn't fall on the person just going to a website to track down the vendors and third parties the website contracts with.