This. It seems like the default model for ad impressions is just "run whatever you want, go wild." Untrusted code? SURE! Ads for blatantly fraudulent product? PARTY TIME! Even more basic shadiness is astonishingly rampant---I recently made the mistake of opening a well-known and very stuffy academic blog with countless daily visitors from a browser not stuffed full of ad blockers, and immediately got a half-naked Ashley Madison ad on my work machine.

What we need is some third-party intermediary to screen, not the ads, but the sites hosting the ads---some kind of certification authority that says "this is a list of websites that don't allow people to run untrusted code or scams," and then allows users to block everything else by default.