> How about publishers serve ads from their own main domain ? ...

Yeah, I'm a big fan of the idea. Imagine this - what if advertisers would give you a small PHP script to include in the website source code, that would run random code on the server, instead of ga.js? Would they think twice before including that crap? I bet they would.

As it stands, I've encountered sites that wanted me to run even 10 different scripts on a page, for ad networks I haven't even heard about.

Also, correct me if I'm wrong, but this would make it virtually impossible for the ad provider to reliably measure how often their ads are viewed, forcing them to consider only clicks in their business model.

This may be a pro or a con, I'm not sure. Would optimising for ad-clicks instead of ad-views encourage more valuable and interesting ads, that one would actually want to know more about? Or would it encourage (literal) big mouse clickbait at the expense of understated, informative, Google Analytics-style text ads?

Ads are not the only nor, afaik, even the most common vector for malware. If your computer can get hacked by you just visiting a webpage, you need to fix that regardless of whether you block ads. It's a huge security problem

If you don't want to get hacked by visiting a website, use cURL (actually, I think it had a few security bugs, so...)

The difference is that websites have rep, and google polices sites with malware protection (which firefox uses too, btw).

What about ads?

This reminds me of the argument that you should run SSH on an non-standard port. Sure, can't hurt. I'm sure it does stop many indiscriminate drive-by attacks. But it's hardly a real security solution. If your SSH server is so weak that it could fall to a drive-by attack then you have much bigger problems.

(And, FWIW, Google's malware blocking applies equally to ads as it does sites you type into the address bar)

Reputation doesn't work well enough because of ads. I think that's the gist of the complaint here.

Ads means otherwise reputable websites serve malware. Even when the ads themselves are trustworthy, they very often do not have acceptable security practices, preventing interception.