Regarding 2: Probably impossible. Regarding 1: hold websites and ad networks legally culpable for delivering malware from ads. Probably also not possible.

Keep blocking ads.

I agree with you on 2 most likely not being possible (or reasonable) given that the revenue model is based in sharing user data, but I'm not so sure that 1 is completely out of the question.

I don't necessarily think that it's reasonable to have a zero tolerance policy for ad networks or the sites serving them regarding malware (cuz perfect security doesn't exist), but what about requiring some basic standard of due diligence for the ad networks themselves?

Zero tolerance, maybe maybe not. But if I ran a restaurant and kept ordering from a supplier that kept giving me deliberately poisoned meat, I should be held responsible.

And there's a reason ads are slow, easily blocked, client-side javascript. Site operators know they serve malware and don't want it on their own servers.

If you have your ad blocker on and the WaPo did this, how would you know to turn it off?

First, word of mouth. Second (better solution) a non-profit certification authority something like Underwriters Laboratories that monitors ad networks for malware, and gives its seal of approval for good ones. WaPo could then advertise that seal on their website.

Then of course when an ad network screws up you have a certificate revocation problem, but that's another story.