21 Oct 2026 Search

Another day of Internet security getting on the front page. Yes, trillions of dollars worth of Internet companies are depending on a PHP Foundation with a budget of $730,534—free-ride much? but others have made that point better.

The thing that bugs me about the security situation lately is, normally, when there’s a security problem, the natural reaction for the maintainers of the affected system is to ask: where else could something similar be happening?

For example, Linux has been using Coccinelle, which includes detection of problematic programming patterns in C code, for decades now. And of course there’s a whole LLM bug finding trend (which Greg Kroah-Hartman explains in Security in the LLM Age). Learn to spot bugs, match patterns, find more bugs.

But remember last week’s big security story?

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware.

Discover-Tech has appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served ads via major networks such as Google, Yandex, and Beeswax.

Yes, a malware distribution operation got on the IAB Europe TCF vendor list. So you might think that the organization responsible for that list would be all, sacré bleu, how did that happen? We’d better check if any other malware is on there!

Instead, the reaction is Recent Reports Concerning a TCF Vendor, Discover-Tech.

Discover-Tech is currently suspended from the GVL following an audit conducted by IAB Europe under its TCF Compliance Programmes, which identified violations of the TCF Policies. The suspension will remain in place until the identified violations have been fully remedied and compliance with the applicable TCF requirements has been verified by IAB Europe.

Further confirmation of the findings published today could also justify a definitive expulsion from the GVL.

While we take reports of illegal practices seriously, we are not equipped or mandated to independently investigate conduct falling outside the substantive scope of the TCF, and will be monitoring any relevant investigations and findings by competent authorities.

Vendors and other market players who have information about the practices by other companies that may not comply with the TCF Policies may also share their concerns via an online form here.

That doesn’t look like taking reports of illegal practices seriously. That’s more like: security? idk lol

Zero effort to go back and check that TCF vendor list for, say, any other vendors running obviously bogus ads for brands they don’t have as clients?

It’s not like the adtech business isn’t capable of freaking the hell out if they really want to freak the hell out. When Apple Safari blocked some third-party web tracking scripts, the industry had a lot to say.

Paul Evans writes, in Apple vs AdTech: The Industry Is Losing an Argument It Should Be Winning,

IAB, WFA, ISBA, IPA and AOP – our predominant industry bodies - represent almost every business that funds, sells or depends on open-web advertising, and each has done serious work on developing standards and guidance regarding privacy and consent. Even so, the open web still has no shared position that a consumer or politician would recognise. Nothing explains in straightforward terms why it deserves to exist and how it behaves.

But the industry does have a shared position. And it’s we are not equipped or mandated to keep OUR APPROVED VENDORS from attacking you.

The view from outside the marketing filter bubble

Check out the coverage in CSO by Taryn Plumb: No click required: How the ad industry became a pipeline for mercenary spyware. This is a view of the situation from neither the privacy nerd side nor the adtech side. CSO is a neutral mainstream professional site for corporate security people. And here’s what they’re recommending, along with some other security advice.

Push a vetted ad-blocking extension to managed browsers through policy rather than leaving it to users to install it.

Disable advertising identifiers on corporate mobile devices through mobile device management (MDM) and restrict ad-supported consumer apps on devices holding sensitive data.

Apple is not using some mystical Reality Distortion Field to persusade people to be all unfairly biased against adtech. James Hercher asks, Has The Ad Industry Lost The Pulse Of American Consumers?, but it’s not just consumers. It’s security professionals too. CSO is only the latest mainstream organization to advise people about the risks of surveillance advertising. The FBI and CERN have already issued ad blocking advice, too.

Yes, I know Apple is doing shenanigans in order to favor their own ads. And yes, Google and Meta ad risks are worse than open web, and Apple plays nice with those companies anyway. In the long run, Apple can’t avoid enshittification any more than any other public company can. But Safari developers are solidly part of the general security consensus, while the adtech business really isn’t.