> Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)
That's a good point. Maybe ad-blockers will impose accountability.
Edit: There's a tendency to be irresponsible when effectively anonymous. But there's still risk. Let's say that some ad network is hosting ransomware. Well over 99% of victims will have no provable damages. But maybe you take out some business and all of the day's backups. There's also the potential for class tort.
When it comes to computer intrusion, you often do not need to prove damages. Many jurisdiction has made it a criminal offense, and other has based damages on the amount of time a professional would spend on repairing the damages.
Each personal computer and laptop should be in the range of a $200. A work desktop or server should be in the range of $2000-5000, since then you got to verify the integrity of data and secrecy of costumers. Since a maladvertisement attack hits tens of thousands of users, a class action suit could be in any range, and it would be hard to guess the end result.
Got burnt by some ransomware, now what? Use that backup you hopefully have and that's it. In the time between backup and damage, the primary browser would have touched just about every ad network in existence and nobody knows how many other unpublished holes might have been responsible for the malware to leak in.
Art the other end of the range, if you are a security expert analyzing the incoming flood, you may have an abstract case of attempted computer fraud, but no concrete damages.
Edit: could this change once ad-blockers have caused the introduction of server-side splicing of ads and content? (I suspect that this will become the main business of edge server operators not too far down the road)