the insecurity department

Another day of Internet security getting on the front page. Yes, trillions of dollars worth of Internet companies are depending on a PHP Foundation with a budget of $730,534—free-ride much? but others have made that point better.

The thing that bugs me about the security situation lately is, normally, when there’s a security problem, the natural reaction for the maintainers of the affected system is to ask: where else could something similar be happening?

For example, Linux has been using Coccinelle, which includes detection of problematic programming patterns in C code, for decades now. And of course there’s a whole LLM bug finding trend (which Greg Kroah-Hartman explains in Security in the LLM Age). Learn to spot bugs, match patterns, find more bugs.

But remember last week’s big security story?

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.

Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served ads via major networks such as Google, Yandex, and Beeswax.

Yes, a malware distribution operation got on the IAB Europe TCF vendor list. So you might think that the organization responsible for that list would be all, sacré bleu, how did that happen? We’d better check if any other malware is on there!

Instead, the reaction is Recent Reports Concerning a TCF Vendor, Discover-Tech.

Discover-Tech is currently suspended from the GVL following an audit conducted by IAB Europe under its TCF Compliance Programmes, which identified violations of the TCF Policies. The suspension will remain in place until the identified violations have been fully remedied and compliance with the applicable TCF requirements has been verified by IAB Europe. Further confirmation of the findings published today could also justify a definitive expulsion from the GVL. While we take reports of illegal practices seriously, we are not equipped or mandated to independently investigate conduct falling outside the substantive scope of the TCF, and will be monitoring any relevant investigations and findings by competent authorities. Vendors and other market players who have information about the practices by other companies that may not comply with the TCF Policies may also share their concerns via an online form here.

That doesn’t look like taking reports of illegal practices seriously. That’s more like: security? idk lol

Zero effort to go back and check that TCF vendor list for, say, any other vendors running obviously bogus ads for brands they don’t have as clients?

It’s not like the adtech business isn’t capable of freaking the hell out if they really want to freak the hell out. When Apple Safari blocked some third-party web tracking scripts, the industry had a lot to say.

Paul Evans writes, in Apple vs AdTech: The Industry Is Losing an Argument It Should Be Winning,

IAB, WFA, ISBA, IPA and AOP – our predominant industry bodies - represent almost every business that funds, sells or depends on open-web advertising, and each has done serious work on developing standards and guidance regarding privacy and consent. Even so, the open web still has no shared position that a consumer or politician would recognise. Nothing explains in straightforward terms why it deserves to exist and how it behaves.

But the industry does have a shared position. And it’s we are not equipped or mandated to keep OUR APPROVED VENDORS from attacking you.

The view from outside the marketing filter bubble

Check out the coverage in CSO by Taryn Plumb: No click required: How the ad industry became a pipeline for mercenary spyware. This is a view of the situation from neither the privacy nerd side nor the adtech side. CSO is a neutral mainstream professional site for corporate security people. And here’s what they’re recommending, along with some other security advice.

Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it. Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.

Apple is not using some mystical Reality Distortion Field to persusade people to be all unfairly biased against adtech. James Hercher asks, Has The Ad Industry Lost The Pulse Of American Consumers?, but it’s not just consumers. It’s security professionals too. CSO is only the latest mainstream organization to advise people about the risks of surveillance advertising. The FBI and CERN have already issued ad blocking advice, too.

Yes, I know Apple is doing shenanigans in order to favor their own ads. And yes, Google and Meta ad risks are worse than open web, and Apple plays nice with those companies anyway. In the long run, Apple can’t avoid enshittification any more than any other public company can. But Safari developers are solidly part of the general security consensus, while the adtech business really isn’t.

Bonus links

The disability inclusion effect by Thomas McKinlay. Include people with disabilities in your ads, doing the same things a non-disabled person would (not showing them as vulnerable, or defined by their disability). People will have a more positive view of your ad, your brand, and will be more likely to choose your product.

Publishers want Brussels and London to stop Meta’s new AI terms by Jacob Parry and Eliza Gkritsi. Europe’s biggest media companies have asked regulators in Brussels and London to stop Meta from introducing new terms they say would let it copy publishers’ websites to build artificial intelligence, as a backlash that began in the U.S. spreads across Europe. (More: Facebook tries to grab all news publisher website content for training for free by David Gerard.)

Budapest Audio Expo 2026 by Peter ‘CzP’ Czanik. We were looking for where the band is hiding, as it sounded like an actual band was there, not just a pair of speakers. Best of all: this was one of the most affordable systems at the expo, beating many more expensive systems in listening experience.

Court appears likely to allow internet suit based on decades-old video privacy law to go forward by Amy Howe (Decades-old? Big deal. Privacy norms vary less across decades than across professions. Where privacy is concerned, a judge or legislator from the late 1960s is going to be closer to the average person of today on privacy than a modern Big Tech exec is.)

‘Reverse-Engineer Anything’ Is the New Wild West of AI by Jason Koebler. (Vibe-coded smart TV firmware isn’t going to be perfect, but it only has to be better than the growth hacking firmware that comes with the TV.)

Did Ukraines data center strikes affect Russias bot army? We now have better evidence. The CCD concluded that strikes on data centers can significantly disrupt Russian influence networks, but the effect appears to be short-lived.